YARA Rules: Syntax, Command Line and Reading Matches

YARA is a pattern-matching tool for malware researchers. You write a rule that combines text or binary strings with a Boolean condition, then scan files or directories to see which rules match. This guide covers what a rule is made of, how to install YARA from the official source, a worked rule with the exact command, and how to read the output. Facts below come from the official YARA documentation (read 2026-11-08).

What YARA rules are used for in research

The YARA project describes the tool as one that helps malware researchers identify and classify malware samples. A rule describes a family or behaviour through strings plus a condition; a match means the file satisfies that description. Researchers use rules to sort sample collections and to pivot between datasets: for example, the MalwareBazaar guide covers a sample repository whose API can query samples by YARA rule match. For where rule matches fit in a wider workflow, see the guide to threat intelligence.

Install or access (official source only)

YARA is multi-platform (Windows, Linux and Mac OS X). The official docs describe compiling from a source tarball. Source code is at github.com/virustotal/yara and documentation at yara.readthedocs.io.

1. Install the build prerequisites. On Ubuntu or Debian: sudo apt-get install automake libtool make gcc pkg-config. flex and bison are needed only if you plan to modify YARA’s source. OpenSSL (libssl-dev) is optional; pass --with-crypto to configure to enforce the OpenSSL-dependent features.
2. Extract the tarball and enter the directory (the docs’ example is tar -zxf yara-4.4.0.tar.gz then cd yara-4.4.0; use the version you downloaded).
3. Build and install: ./bootstrap.sh, ./configure, make, sudo make install.
4. Run the test cases: make check.

The cuckoo, magic and dotnet modules are not compiled by default. Enable them at configure time with --enable-cuckoo, --enable-magic or --enable-dotnet. The cuckoo module needs Jansson (libjansson-dev) and the magic module needs libmagic (libmagic-dev on Ubuntu, Debian and CentOS). YARA can also be used from Python through yara-python.

Step by step: write a rule and scan with it

1. Check the install with the minimal rule

echo "rule dummy { condition: true }" > my_first_rule
yara my_first_rule my_first_rule

The file is used as both rules file and target. Expected output is dummy my_first_rule. On Windows PowerShell the same command can fail with error: non-ascii character; create the file with ASCII encoding instead: Set-Content -path .my_first_rule -Value "rule dummy { condition: true }" -Encoding Ascii then .yara my_first_rule my_first_rule.

2. Learn the rule anatomy

A rule starts with the rule keyword and an identifier. It has an optional strings: section, a required condition: section, and an optional meta: section. Metadata cannot be referenced in conditions. Comments use /* */ or //.

• Text strings are in double quotes; regular expressions are in slashes.
• Hex strings go in braces and support the wildcard ??, the NOT operator ~00, jumps such as [4-6] and alternatives such as ( 62 B4 | 56 ).
• Modifiers: nocase; wide (two bytes per character); ascii (the default, but you must state it alongside wide to match both forms); fullword; xor (all single-byte keys); base64.
• Conditions can use any of them or all of them, filesize, and integer reads such as uint16(0) == 0x5A4D, which checks for the MZ header. include "other.yar" pulls in another rules file.

3. A worked rule built from those elements

rule example_mz_marker
{
    meta:
        description = "Teaching example, not a detection for real malware"
    strings:
        $txt = "example-marker" ascii wide nocase
        $hex = { 6A ?? 68 }
    condition:
        uint16(0) == 0x5A4D and filesize < 2000000 and any of them
}

Read the condition left to right: the file must begin with the two bytes that spell “MZ” (a Windows executable header), be smaller than 2,000,000 bytes, and contain at least one of the two strings. The text string matches in ASCII and two-byte-per-character form, ignoring case; the hex string matches the byte 6A, any one byte, then 68.

4. Scan

yara -s -m -r example.yar sample_folder

Command-line form is yara [OPTIONS] RULES_FILE TARGET. Options from the official command-line reference:

Option	Effect
-r	Scan directories recursively (follows symlinks)
-s	Print the matching strings
-m	Print rule metadata
-g	Print rule tags
-c	Print only the number of matches
-n	Negate: print only rules that were not satisfied
-t <tag>	Print only rules carrying that tag
-p <n>	Number of threads for a directory scan
-C	Load rules compiled with yarac (yara [OPTIONS] -C RULES_FILE TARGET)

Output and how to read it

Each match is printed as the rule name followed by the path of the file that matched, as in dummy my_first_rule. A file that matches nothing prints nothing. Add -s to see which strings triggered the match and -m to see the metadata. Use -c when you only need counts, and -n to list rules that did not match, which helps when checking that a rule does not fire on clean files.

Troubleshooting

• Non-ASCII error on Windows PowerShell: write the rules file with ASCII encoding (see step 1).
• A compiled rules file will not load: since YARA 3.9, -C is required to load rules compiled with yarac. This prevents running third-party compiled rules by accident. Compiled rules load faster, and the compiled rules argument accepts a single file.
• Module unavailable: cuckoo, magic and dotnet must be enabled at configure time and need their library dependencies.
• Wide-character text not matching: add wide, and ascii as well if you want both forms.

Free alternatives and related tools

YARA matches patterns in files and memory. Other free tools cover neighbouring jobs, and some read YARA rules directly.

Tool	What it does	Relation to YARA	Official source
ClamAV	Open-source antivirus engine with hash, body-based and logical signatures	Its documentation states that ClamAV 0.99 and above support signatures written in the YARA format	docs.clamav.net/manual/Signatures.html
Sigma	An open format for writing detection rules in YAML, translated into the query language of a SIEM platform	Targets log events rather than file contents, so it complements YARA instead of replacing it	sigmahq.io/docs/guide/getting-started.html

Choose by what you are matching: file or memory content suits YARA or ClamAV signatures; log events suit Sigma.

Frequently asked questions

What are YARA rules?

They are text files that pair strings (text, hex or regular expressions) with a Boolean condition. A file matches when the condition is true. The project describes YARA as a tool for malware researchers to identify and classify samples.

Does a rule have to contain strings?

No. Only the condition: section is required; the docs’ minimal rule is rule dummy { condition: true }.

Can YARA run from Python?

Yes. The project page lists yara-python alongside the command-line tool.

Sources

• YARA documentation, Getting started: yara.readthedocs.io/en/stable/gettingstarted.html (read 2026-11-08)
• YARA documentation, Running YARA from the command-line: yara.readthedocs.io/en/stable/commandline.html (read 2026-11-08)
• YARA documentation, Writing YARA rules: yara.readthedocs.io/en/stable/writingrules.html (read 2026-11-08)
• VirusTotal YARA project page: virustotal.github.io/yara (read 2026-11-08)
• ClamAV documentation, Signatures: docs.clamav.net/manual/Signatures.html (read 2026-11-08)
• Sigma documentation, Getting started: sigmahq.io/docs/guide/getting-started.html (read 2026-11-08)